Software Engineering Institute | Carnegie Mellon©
CERT NetSA Security Suite
Monitoring for Large-Scale Networks

YAF

Documentation

YAF

  • Documentation
  • Downloads
  • Main Page
  • Data Structures
  • Files
  • File List
  • Globals

decode.h

00001 /*
00002  * @internal
00003  *
00004  ** @file decode.h
00005  ** YAF Layer 2 and Layer 3 decode routines
00006  **
00007  ** ------------------------------------------------------------------------
00008  ** Copyright (C) 2007-2011 Carnegie Mellon University. All Rights Reserved.
00009  ** ------------------------------------------------------------------------
00010  ** Authors: Brian Trammell
00011  ** ------------------------------------------------------------------------
00012  ** @OPENSOURCE_HEADER_START@  
00013  ** Use of the YAF system and related source code is subject to the terms 
00014  ** of the following licenses:
00015  ** 
00016  ** GNU Public License (GPL) Rights pursuant to Version 2, June 1991
00017  ** Government Purpose License Rights (GPLR) pursuant to DFARS 252.227.7013
00018  ** 
00019  ** NO WARRANTY
00020  ** 
00021  ** ANY INFORMATION, MATERIALS, SERVICES, INTELLECTUAL PROPERTY OR OTHER 
00022  ** PROPERTY OR RIGHTS GRANTED OR PROVIDED BY CARNEGIE MELLON UNIVERSITY 
00023  ** PURSUANT TO THIS LICENSE (HEREINAFTER THE "DELIVERABLES") ARE ON AN 
00024  ** "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY 
00025  ** KIND, EITHER EXPRESS OR IMPLIED AS TO ANY MATTER INCLUDING, BUT NOT 
00026  ** LIMITED TO, WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE, 
00027  ** MERCHANTABILITY, INFORMATIONAL CONTENT, NONINFRINGEMENT, OR ERROR-FREE 
00028  ** OPERATION. CARNEGIE MELLON UNIVERSITY SHALL NOT BE LIABLE FOR INDIRECT, 
00029  ** SPECIAL OR CONSEQUENTIAL DAMAGES, SUCH AS LOSS OF PROFITS OR INABILITY 
00030  ** TO USE SAID INTELLECTUAL PROPERTY, UNDER THIS LICENSE, REGARDLESS OF 
00031  ** WHETHER SUCH PARTY WAS AWARE OF THE POSSIBILITY OF SUCH DAMAGES. 
00032  ** LICENSEE AGREES THAT IT WILL NOT MAKE ANY WARRANTY ON BEHALF OF 
00033  ** CARNEGIE MELLON UNIVERSITY, EXPRESS OR IMPLIED, TO ANY PERSON 
00034  ** CONCERNING THE APPLICATION OF OR THE RESULTS TO BE OBTAINED WITH THE 
00035  ** DELIVERABLES UNDER THIS LICENSE.
00036  ** 
00037  ** Licensee hereby agrees to defend, indemnify, and hold harmless Carnegie 
00038  ** Mellon University, its trustees, officers, employees, and agents from 
00039  ** all claims or demands made against them (and any related losses, 
00040  ** expenses, or attorney's fees) arising out of, or relating to Licensee's 
00041  ** and/or its sub licensees' negligent use or willful misuse of or 
00042  ** negligent conduct or willful misconduct regarding the Software, 
00043  ** facilities, or other rights or assistance granted by Carnegie Mellon 
00044  ** University under this License, including, but not limited to, any 
00045  ** claims of product liability, personal injury, death, damage to 
00046  ** property, or violation of any laws or regulations.
00047  ** 
00048  ** Carnegie Mellon University Software Engineering Institute authored 
00049  ** documents are sponsored by the U.S. Department of Defense under 
00050  ** Contract FA8721-05-C-0003. Carnegie Mellon University retains 
00051  ** copyrights in all material produced under this contract. The U.S. 
00052  ** Government retains a non-exclusive, royalty-free license to publish or 
00053  ** reproduce these documents, or allow others to do so, for U.S. 
00054  ** Government purposes only pursuant to the copyright license under the 
00055  ** contract clause at 252.227.7013.
00056  ** 
00057  ** @OPENSOURCE_HEADER_END@    
00058  ** ------------------------------------------------------------------------
00059  */
00060 
00075 #ifndef _YAF_DECODE_H_
00076 #define _YAF_DECODE_H_
00077 
00078 #include <yaf/autoinc.h>
00079 #include <yaf/yafcore.h>
00080 
00082 typedef struct yfIPFragInfo_st {
00084     uint32_t        ipid;
00086     uint16_t        offset;
00088     uint16_t        iphlen;
00093     uint16_t        l4hlen;
00098     uint8_t         frag;
00102     uint8_t         more;
00103 } yfIPFragInfo_t;
00104 
00106 #define YF_MPLS_LABEL_COUNT_MAX     10
00107 
00109 typedef struct yfL2Info_st {
00111     uint8_t         smac[6];
00113     uint8_t         dmac[6];
00115     uint16_t        l2hlen;
00117     uint16_t        vlan_tag;
00119     uint32_t        mpls_count;
00121     uint32_t        mpls_label[YF_MPLS_LABEL_COUNT_MAX];
00122 } yfL2Info_t;
00123 
00125 typedef struct yfTCPInfo_st {
00127     uint32_t        seq;
00129     uint8_t         flags;
00130 } yfTCPInfo_t;
00131 
00133 typedef struct yfPBuf_st {
00135     uint64_t        ptime;
00137     yfFlowKey_t     key;
00139     uint16_t        iplen;
00141     uint16_t        ifnum;
00143     yfTCPInfo_t     tcpinfo;
00145     yfL2Info_t      l2info;
00147 #   if defined(YAF_ENABLE_DAG_SEPARATE_INTERFACES) || defined(YAF_ENABLE_NAPATECH_SEPARATE_INTERFACES) || defined(YAF_ENABLE_P0F) || defined(YAF_ENABLE_FPEXPORT)
00148     size_t          headerLen;
00150     uint8_t         headerVal[YFP_IPTCPHEADER_SIZE];
00151 #   endif
00152 
00153     size_t          paylen;
00157     uint8_t         payload[1];
00158 } yfPBuf_t;
00159 
00161 #define YF_PBUFLEN_NOL2INFO offsetof(yfPBuf_t, l2info)
00162 
00164 #define YF_PBUFLEN_NOPAYLOAD offsetof(yfPBuf_t, paylen)
00165 
00167 #define YF_PBUFLEN_BASE offsetof(yfPBuf_t, payload)
00168 
00169 struct yfDecodeCtx_st;
00171 typedef struct yfDecodeCtx_st yfDecodeCtx_t;
00172 
00174 #define YF_TYPE_IPv4    0x0800
00175 
00176 #define YF_TYPE_IPv6    0x86DD
00177 
00181 #define YF_TYPE_IPANY   0x0000
00182 
00184 #define YF_PROTO_IP6_HOP    0
00185 
00186 #define YF_PROTO_ICMP       1
00187 
00188 #define YF_PROTO_TCP        6
00189 
00190 #define YF_PROTO_UDP        17
00191 
00192 #define YF_PROTO_IP6_ROUTE  43
00193 
00194 #define YF_PROTO_IP6_FRAG   44
00195 
00196 #define YF_PROTO_GRE        47
00197 
00198 #define YF_PROTO_ICMP6      58
00199 
00200 #define YF_PROTO_IP6_NONEXT  59
00201 
00202 #define YF_PROTO_IP6_DOPT   60
00203 
00205 #define YF_TF_FIN   0x01
00206 
00207 #define YF_TF_SYN   0x02
00208 
00209 #define YF_TF_RST   0x04
00210 
00211 #define YF_TF_PSH   0x08
00212 
00213 #define YF_TF_ACK   0x10
00214 
00215 #define YF_TF_URG   0x20
00216 
00217 #define YF_TF_ECE   0x40
00218 
00219 #define YF_TF_CWR   0x80
00220 
00239 yfDecodeCtx_t *yfDecodeCtxAlloc(
00240     int             datalink,
00241     uint16_t        reqtype,
00242     gboolean        gremode);
00243 
00249 void yfDecodeCtxFree(
00250     yfDecodeCtx_t           *ctx);
00251 
00287 gboolean yfDecodeToPBuf(
00288     yfDecodeCtx_t           *ctx,
00289     uint64_t                ptime,
00290     size_t                  caplen,
00291     const uint8_t           *pkt,
00292     yfIPFragInfo_t          *fraginfo,
00293     size_t                  pbuflen,
00294     yfPBuf_t                *pbuf);
00295 
00304 uint64_t yfDecodeTimeval(
00305     const struct timeval    *tv);
00306 
00315 uint64_t yfDecodeTimeNTP(
00316     uint64_t                ntp);
00317 
00325 void yfDecodeDumpStats(
00326     yfDecodeCtx_t       *ctx,
00327     uint64_t            packetTotal); 
00328 
00335 uint32_t yfGetDecodeStats(
00336     yfDecodeCtx_t *ctx);
00337 
00338 
00352 gboolean yfDefragTCP(
00353     uint8_t             *pkt,
00354     size_t              *caplen,
00355     yfFlowKey_t         *key,
00356     yfIPFragInfo_t      *fraginfo,
00357     yfTCPInfo_t         *tcpinfo,
00358     size_t              *payoff);
00359 
00360 /* end idem */
00361 #endif 
© 2006-2011 Carnegie Mellon University